Data Processing Agreement
This agreement forms part of the Terms of Service and applies whenever Hudoori processes personal data on behalf of a company using the service.
1. Roles
The company is the controller. Hudoori is the processor. The company decides that attendance is recorded, whose attendance is recorded, at which workplaces, by which methods, and who may see the result. Hudoori processes that data only on the company's documented instruction.
Using the service is that instruction. Anything beyond it is agreed separately and in writing.
2. Subject matter and duration
Subject matter: recording and verifying employee attendance, and producing the attendance record derived from it.
Duration: for as long as the company's account exists, plus the export window in clause 8.
Categories of data subject: the company's employees and contractors, and the managers and HR staff it gives dashboard accounts to.
Categories of personal data:
- identity: name, employee code, phone number, Telegram identifier and username
- for dashboard users: email address and a password hash
- attendance: check-in and check-out events with server timestamps
- verification evidence: GPS coordinates and reported accuracy, public IP address, scanned workplace code, bound device identity
- requests, approvals, corrections and the audit record of who made each
No special categories of personal data are processed. Hudoori does not collect health data, biometric data, or anything derived from either.
3. Hudoori's obligations
Hudoori will:
- process personal data only on the company's instruction, and tell the company if an instruction appears to breach the law
- ensure that everyone with access is bound by confidentiality
- apply the security measures in clause 5
- not engage a sub-processor without telling the company first
- assist the company in answering data-subject requests and in any assessment or consultation the law requires of it
- tell the company without undue delay of any personal-data breach, and tell it what was affected
- on the company's instruction, delete or return the data, subject to clause 8
4. Sub-processors
| Who | Purpose | Location |
|---|---|---|
| Amazon Web Services | hosting, storage and backup of all application data | Frankfurt, Germany (eu-central-1) |
| Telegram | delivery of the employee interface and bot messages | Telegram's infrastructure |
| Email provider | delivery of transactional email | as stated by that provider |
Hudoori remains responsible to the company for its sub-processors' acts.
The company acknowledges that where its employees use the Telegram interface, their Telegram account identity and the content of bot messages are processed by Telegram under Telegram's own terms. Attendance records, evidence and scores are never transmitted to Telegram.
5. Security measures
- encryption in transit (TLS) and at rest
- tenant isolation enforced at the database layer, not in application code
- access limited to named operators, and every access logged
- passwords stored only as hashes, checked against known breached credentials
- device binding, so an event can be attributed to a specific bound handset
- append-only attendance events: no update path and no delete path exists
- a full audit record of every state change — who, what, when, which device, why
- nightly backups with a tested restore procedure
- an ingestion path with no data written outside the tenant's own scope
6. Cross-border transfer
Personal data is processed on Amazon Web Services in Frankfurt, Germany, and is therefore transferred outside Egypt.
Hudoori commits to the safeguards within its control: encryption in transit and at rest, restricted and logged access, no onward transfer beyond the sub-processors in clause 4, and prior notice of any change to where data is processed.
The parties acknowledge that Law 151/2020 governs this transfer and will cooperate in putting in place whatever additional mechanism the competent authority requires, including entering into standard contractual clauses if that is the route adopted.
7. Data-subject requests
Requests from employees go to the company, as controller. Where a request reaches Hudoori directly, Hudoori will not answer it substantively and will pass it to the company without undue delay.
The product gives every employee sight of their own record and the evidence behind every day of it, which is intended to satisfy most access requests without a formal process.
Correction is by supersession: a correction is a new event naming who made it, and the original remains. The company acknowledges that this is the design and that a request to erase an individual attendance event cannot be met without erasing the integrity of the record it belongs to.
8. Return and deletion
On closure of the account, the company has 90 days during which its full record remains available for export from the product.
At the end of that window, all personal data held for that company is erased automatically and irreversibly. The fact and time of erasure are recorded. Backups containing that data age out on their own retention cycle, which does not exceed 14 days.
9. Audit
Hudoori will provide the company with the information reasonably needed to demonstrate compliance with this agreement, and will cooperate with an audit carried out by the company or an auditor it appoints, on reasonable notice and no more than once a year unless an incident makes more necessary.